[AusNOG] network security Question

[Roland Dobbins]

On May 20, 2014, at 10:36 AM, Alex Samad - Yieldbroker <Alex.Samad at yieldbroker.com> wrote:

> I like the idea of allowing icmp through, make network diagnosis a lot easier, but I don't want to be bomb.

At a minimum, ICMP Type-3/Code-4 is necessary for PMTU-D.  Block it, and you will break things.

>  What sort of rate limiting do people think is acceptable?

Depends upon your network type, traffic, etc.

> What's acceptable from client to confirm connectivity?

ICMP Echo Request, Echo Reply, and Don't Fragment (Type-3/Code-4).

> I asking as an end user, but I am also curious to know what providers do.

For scanning?  Generally, nothing, unless it's so aggressive that it constitutes a DDoS.

<https://app.box.com/s/osk4po8ietn1zrjjmn8b>

----------------------------------------------------------------------
Roland Dobbins <rdobbins at arbor.net> // <http://www.arbornetworks.com>

                   Equo ne credite, Teucri.

    		   	  -- Laocoön